RE: [Maybe spam] Security - what security?

Is your Windows username and password valid authentication on the AIX box? Could it be using pass through authentication? Regards Simon -----Original Message----- From: owner-informix-list@iiug.org [mailto:owner-informix-list@iiug.org] On Behalf Of mweallans@panacea.co.uk Sent: 11 August 2005 13:15 To: informix-list@iiug.org Subject: [Maybe spam] Security - what security? I've been doing some investigation into a little problem with privileges. And this is what I have found. If you want to access an Informix database via ODBC and your normal login and password are restricted then set up your odbc connection with no user name and password and you can do anything. This is what I did to prove it. 1. I created a new database called security. 2. I added two tables - opentab and securetab 3. I revoked all permissions on securetab from public 4. I granted connect to public. 5. From MS-Access I set up a new database 6. I used "link-tables" to add a new odbc connection with no username or password, and to link both tables. 7. I could SELECT, INSERT, UPDATE, and DELETE from both tables. 8. I then deleted both tables from my access database. and used control panel to remove the odbc connection. 9. I then repeated steps 5-7 but with a valid username and password. 10. I couldn't access the securetab. So, using a username and password is secure but not using a username and password gives full access. Can anybody spot anything wrong in my reasoning? BTW I have done this on IDS 9.4, running on AIX 5.2, and I was running Windows XP with MS-Access 2002 SP3, and Informix-Client SDK version 2.81 regards Malcolm ********************************************************************** The information in this e-mail and any attachment is confidential. It is intended only for the named recipient(s). If you are not a named recipient please notify the sender immediately and do not disclose the contents to another person or take copies. Although Axxia Systems has taken every reasonable precaution to ensure that any attachment to this e-mail has been checked for viruses, it is strongly recommended that you carry out your own virus check before opening any attachment, as we cannot accept liability for any damage sustained as a result of software virus infection. Axxia Systems reserves the right and senders of messages shall be taken to consent to the monitoring and recording of e-mails addressed to axxia.com. ********************************************************************** sending to informix-list